ssl6 min readUpdated 2026-01-01
HTTPS: The Non-Negotiable Baseline
HTTPS is a floor, not a feature. Chrome, Firefox and Safari all flag http:// pages as insecure, browsers block sensitive APIs on HTTP, and search engines demote HTTP results.
Getting a certificate
Free from Let's Encrypt, ZeroSSL or Cloudflare. Automate renewal — expired certificates are the number one cause of self-inflicted downtime.
Enforcing HTTPS
Redirect http:// to https:// with a 301, then set HSTS. Do not skip the redirect — clients that don't honor HSTS still land somewhere.
Frequently asked questions
Try it on your site
Run a free Website Auditor scan and see which of these controls you're missing.
Run a scan